Skip to content

fix(deps)(deps): bump the dependencies group with 4 updates - #1924

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-5cc3136d9a
Nov 5, 2026
Merged

fix(deps)(deps): bump the dependencies group with 4 updates#1924
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-5cc3136d9a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 5, 2026

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 4 updates: i18next, react-i18next, @vitest/coverage-v8 and vitest.

Updates i18next from 26.6.0 to 26.7.1

Release notes

Sourced from i18next's releases.

v26.7.1

  • fix: reloadResources() retries the bundles that failed to load. The load queue skipped them also when reloading, so a language whose first load failed (a backend or network outage at startup) stayed missing. i18next-http-backend 4.0.8, i18next-chained-backend 5.0.7 and i18next-locize-backend 10.0.5 reload through reloadResources() with i18next 26.7, so their reloadInterval no longer recovered from such a failure, as their own reload did before.
  • fix: reloadResources() without languages reloads the current languages and every language the backend loaded or tried to load, for the instance and its clones, as the API docs describe ("pass languages and namespaces if you don't want to reload all"). It reloaded only the current languages, so on a server (one clone per request with i18next-http-middleware) a backend's reloadInterval never refreshed the languages loaded for requests. It never requests cimode. With languages given, nothing changes.

v26.7.0

The last 26.x minor before v27, which follows in about a week. It adds the APIs v27 builds on, and with debug: true it warns wherever a setup relies on something v27 changes. Most of the v27 defaults are existing options, so you can try them now:

i18next.init({
  debug: true, // prints the warnings below
  fallbackLng: 'en', // v27: fallbackLng defaults to false, set your source language (no implicit 'dev')
  returnEmptyString: false, // v27 default: an empty string falls back like a missing key
  cleanCode: true, // close to v27, which canonicalizes codes without a region ('EN' becomes 'en')
});
declare module 'i18next' {
  interface CustomTypeOptions {
    strictInterpolationChecks: true; // v27 default
    returnEmptyString: false; // v27 default
  }
}

The other v27 changes (/ no longer escaped in values, a logger and post-processors per instance, the key instead of a sentence for an object hit, the dotted-language store calls and *Escaped options removed) have no switch; the debug warnings below show where they apply.

  • feat: with the default skipOnVariables: true, a missing interpolation variable is now logged in debug mode, once per string and variable: missed to pass in variable name for interpolating Hello {{name}}. The raw {{name}} reached the UI without any log line, even with debug: true, because the warning only ran with skipOnVariables: false. A variable passed as undefined and a missingInterpolationHandler still log nothing.
  • feat: i18next.hydrate(resources, lng) puts resources rendered on the server into the store and changes to the server's language, each only the first time. It does what react-i18next's useSSR did by writing resourceStore.data, options.ns, isInitialized, initializedStoreOnce and initializedLanguageOnce directly, and sets the same flags, so integrations can switch to it and stay compatible with code that still reads or writes them. On a clone it does nothing, as useSSR does: a clone shares its parent's store (one clone per request with i18next-http-middleware). Called before init(), it logs a warning and changes nothing.
  • feat: services.utils.reloadResources() lets a backend reload its bundles through i18next (as i18next.reloadResources(), with retries and the loaded event), instead of calling backendConnector.read() and loaded() itself as the reloadInterval of i18next-http-backend and i18next-chained-backend does. Without languages (no lng, no detector, the default fallbackLng), reloadResources() reloads nothing instead of throwing Cannot read properties of undefined (reading 'forEach'); a backend that also reloads preload passes its languages.
  • feat: backends and async language detectors can declare their calling convention with callbackApi (an instance or static property). true: read(language, namespace, callback), create(languages, namespace, key, fallbackValue, callback, options) and detect(callback); false: they return a promise or a value, and create gets the options as its fifth argument. Without it, i18next keeps guessing from the number of parameters (Function.length), which default and rest parameters change: i18next-chained-backend's create(..., clb = () => {}, opts = {}) has length 4 and never got its options (isUpdate), and i18next-http-backend's callback form of create has length 5, the length reserved for the callback-less form. Guessing is deprecated: in debug mode an unmarked backend or async detector logs a deprecation warning, once per init().
  • feat: isSafeLanguageCode(code) is exported for plugins that take a language from a request, a URL or storage: letters, digits, -, _, @ and . (no ..), at most 128 characters, not a prototype key. It is not a BCP 47 check, so en_US, zh_Hant_TW, sr@latin and de_DE.UTF-8 pass; markup, slashes and spaces do not. The language detector, i18next-http-middleware and i18next-http-backend each have their own rule today.
  • feat: use() logs a warning in debug mode when a second backend, language detector, i18nFormat or formatter replaces the first one; only one of each is used per instance, and losing an ICU setup this way was silent. As use() usually runs before init(), the warning is printed once init() has set up the logger.
  • feat(types): ParseKeysWithoutVariables<Ns, KPrefix>, the keys t() takes without options: their string has no variables, and a plural key is left out when its forms take count. A wrapper typed with it, like (key: ParseKeysWithoutVariables<'common'>) => t(key), compiles with strictInterpolationChecks without a cast.
  • feat(types): defaultVariables in CustomTypeOptions declares the variables interpolation.defaultVariables fills in at runtime (defaultVariables: { appName: string }). They become optional in the t() options, also with strictInterpolationChecks; passed, they keep their type.
  • feat(types): interpolationFormatSeparator in CustomTypeOptions for a custom interpolation.formatSeparator: the types split {{price, currency}} at a hard-coded ,, so with formatSeparator: ';' the format was not recognized. The per-call skipInterpolation option is typed, and returnedObjectHandler may return a value (what it returns is what t() returns; it was typed as returning void).
  • feat(types): SelectorFn, ApplyTarget, ConstrainTarget and GetSource are exported on purpose, under their current names. react-i18next imports them for Trans; they were importable only because every declaration in the type files counts as exported.
  • fix(types): with nsSeparator: false in CustomTypeOptions, the key union no longer contains nsfalsekey-style keys for the other namespaces, and a key that contains the text false (isfalsey) is no longer split at it, which typed its t() result as never.
  • fix: with clones (i18next-http-middleware makes one per request), saveMissing now checks that the namespace is loaded for the instance that misses the key. Each cloneInstance() pointed the parent's services.utils.hasLoadedNamespace at the new clone, and the backend connector, which all clones share, used that one: a key missing in one request was not saved (did not save key ... as the namespace ... was not yet loaded) while a newer request was still loading its language, and the parent's services.utils answered for the newest clone. A clone's services.utils is now bound to the clone, and the parent keeps its own. A direct services.backendConnector.saveMissing() call, like the missing keys route of i18next-http-middleware, still checks the newest clone (follow-up to #1413).
  • fix: dir() without a language (before init(), or with no language resolved) returns 'ltr' instead of 'rtl' ([discussion #2135](Why 'rtl' is default direction in case of language not found? i18next/i18next#2135)).
  • fix: t() before init() returns an empty string, as typed (with a warning when debug logging is already on); it returned undefined.
  • fix: off('a b', listener) removes the listener from both events, as on('a b', listener) adds it to both. It looked for an event named 'a b', so once('a b', listener) never removed its listener and ran it on every event.
  • deprecate: dotted languages in the resource store calls (getResource('en.translation.key'), addResource('en.translation.key', value), addResourceBundle('en.translation', resources)) log a deprecation warning in debug mode; they are removed in v27. Pass language, namespace and key as separate arguments.
  • deprecate: interpolation.prefixEscaped, suffixEscaped, nestingPrefixEscaped and nestingSuffixEscaped (inserted into the RegExp unescaped) log a deprecation warning in debug mode and are marked @deprecated; they are removed in v27. Pass the literal delimiters as prefix, suffix, nestingPrefix and nestingSuffix.
  • deprecate: compatibilityJSON is marked @deprecated (it has no effect since v24) and removed from the types in v27.
  • deprecate: a language code without a region that v27 canonicalizes differently logs a deprecation warning in debug mode: 'EN' stays 'EN' today and becomes 'en' in v27, 'iw' becomes 'he'. cleanCode: true already lower-cases them.
  • deprecate: when fallbackLng is not set, the first request for the default fallback language dev (loading it, or saving missing keys to it) logs a notice in debug mode: v27 defaults to fallbackLng: false and no longer requests dev. Set fallbackLng to your source language, or to 'dev' to keep the current behavior.
  • deprecate: in debug mode, a language code that comes from lng, changeLanguage() or the language detector, is not configured (supportedLngs, fallbackLng, preload or the resources) and fails isSafeLanguageCode logs a deprecation warning, once per code: without supportedLngs, a detector that returns "><img src=x onerror=alert(1)> makes that string i18next.language, and apps put it into <html lang>. Nothing changes in 26.7; v27 is planned to refuse such codes and continue as with an unsupported code. Language codes are still not bound to a format.
  • deprecate: the logger and post-processors are shared by all instances in v26 and per instance from v27 (clones keep their parent's). In debug mode, an instance that runs a post-processor only another instance registered with use() logs a deprecation warning (call use() on this instance too), and a non-clone init() that replaces the logger another instance set with use() logs one through that logger.
  • deprecate: in debug mode, a value with a / under the default escape logs that v27 no longer escapes / ($10/month renders as $10&#x2F;month today; not with escapeValue: false, where react-i18next's Trans escapes one call itself and decodes the entities afterwards), and an object or array hit without returnObjects logs that v27 returns the key instead of the sentence key '... (en)' returned an object instead of string..

... (truncated)

Changelog

Sourced from i18next's changelog.

26.7.1

  • fix: reloadResources() retries the bundles that failed to load. The load queue skipped them also when reloading, so a language whose first load failed (a backend or network outage at startup) stayed missing. i18next-http-backend 4.0.8, i18next-chained-backend 5.0.7 and i18next-locize-backend 10.0.5 reload through reloadResources() with i18next 26.7, so their reloadInterval no longer recovered from such a failure, as their own reload did before.
  • fix: reloadResources() without languages reloads the current languages and every language the backend loaded or tried to load, for the instance and its clones, as the API docs describe ("pass languages and namespaces if you don't want to reload all"). It reloaded only the current languages, so on a server (one clone per request with i18next-http-middleware) a backend's reloadInterval never refreshed the languages loaded for requests. It never requests cimode. With languages given, nothing changes.

26.7.0

The last 26.x minor before v27, which follows in about a week. It adds the APIs v27 builds on, and with debug: true it warns wherever a setup relies on something v27 changes. Most of the v27 defaults are existing options, so you can try them now:

i18next.init({
  debug: true, // prints the warnings below
  fallbackLng: 'en', // v27: fallbackLng defaults to false, set your source language (no implicit 'dev')
  returnEmptyString: false, // v27 default: an empty string falls back like a missing key
  cleanCode: true, // close to v27, which canonicalizes codes without a region ('EN' becomes 'en')
});
declare module 'i18next' {
  interface CustomTypeOptions {
    strictInterpolationChecks: true; // v27 default
    returnEmptyString: false; // v27 default
  }
}

The other v27 changes (/ no longer escaped in values, a logger and post-processors per instance, the key instead of a sentence for an object hit, the dotted-language store calls and *Escaped options removed) have no switch; the debug warnings below show where they apply.

  • feat: with the default skipOnVariables: true, a missing interpolation variable is now logged in debug mode, once per string and variable: missed to pass in variable name for interpolating Hello {{name}}. The raw {{name}} reached the UI without any log line, even with debug: true, because the warning only ran with skipOnVariables: false. A variable passed as undefined and a missingInterpolationHandler still log nothing.
  • feat: i18next.hydrate(resources, lng) puts resources rendered on the server into the store and changes to the server's language, each only the first time. It does what react-i18next's useSSR did by writing resourceStore.data, options.ns, isInitialized, initializedStoreOnce and initializedLanguageOnce directly, and sets the same flags, so integrations can switch to it and stay compatible with code that still reads or writes them. On a clone it does nothing, as useSSR does: a clone shares its parent's store (one clone per request with i18next-http-middleware). Called before init(), it logs a warning and changes nothing.
  • feat: services.utils.reloadResources() lets a backend reload its bundles through i18next (as i18next.reloadResources(), with retries and the loaded event), instead of calling backendConnector.read() and loaded() itself as the reloadInterval of i18next-http-backend and i18next-chained-backend does. Without languages (no lng, no detector, the default fallbackLng), reloadResources() reloads nothing instead of throwing Cannot read properties of undefined (reading 'forEach'); a backend that also reloads preload passes its languages.
  • feat: backends and async language detectors can declare their calling convention with callbackApi (an instance or static property). true: read(language, namespace, callback), create(languages, namespace, key, fallbackValue, callback, options) and detect(callback); false: they return a promise or a value, and create gets the options as its fifth argument. Without it, i18next keeps guessing from the number of parameters (Function.length), which default and rest parameters change: i18next-chained-backend's create(..., clb = () => {}, opts = {}) has length 4 and never got its options (isUpdate), and i18next-http-backend's callback form of create has length 5, the length reserved for the callback-less form. Guessing is deprecated: in debug mode an unmarked backend or async detector logs a deprecation warning, once per init().
  • feat: isSafeLanguageCode(code) is exported for plugins that take a language from a request, a URL or storage: letters, digits, -, _, @ and . (no ..), at most 128 characters, not a prototype key. It is not a BCP 47 check, so en_US, zh_Hant_TW, sr@latin and de_DE.UTF-8 pass; markup, slashes and spaces do not. The language detector, i18next-http-middleware and i18next-http-backend each have their own rule today.
  • feat: use() logs a warning in debug mode when a second backend, language detector, i18nFormat or formatter replaces the first one; only one of each is used per instance, and losing an ICU setup this way was silent. As use() usually runs before init(), the warning is printed once init() has set up the logger.
  • feat(types): ParseKeysWithoutVariables<Ns, KPrefix>, the keys t() takes without options: their string has no variables, and a plural key is left out when its forms take count. A wrapper typed with it, like (key: ParseKeysWithoutVariables<'common'>) => t(key), compiles with strictInterpolationChecks without a cast.
  • feat(types): defaultVariables in CustomTypeOptions declares the variables interpolation.defaultVariables fills in at runtime (defaultVariables: { appName: string }). They become optional in the t() options, also with strictInterpolationChecks; passed, they keep their type.
  • feat(types): interpolationFormatSeparator in CustomTypeOptions for a custom interpolation.formatSeparator: the types split {{price, currency}} at a hard-coded ,, so with formatSeparator: ';' the format was not recognized. The per-call skipInterpolation option is typed, and returnedObjectHandler may return a value (what it returns is what t() returns; it was typed as returning void).
  • feat(types): SelectorFn, ApplyTarget, ConstrainTarget and GetSource are exported on purpose, under their current names. react-i18next imports them for Trans; they were importable only because every declaration in the type files counts as exported.
  • fix(types): with nsSeparator: false in CustomTypeOptions, the key union no longer contains nsfalsekey-style keys for the other namespaces, and a key that contains the text false (isfalsey) is no longer split at it, which typed its t() result as never.
  • fix: with clones (i18next-http-middleware makes one per request), saveMissing now checks that the namespace is loaded for the instance that misses the key. Each cloneInstance() pointed the parent's services.utils.hasLoadedNamespace at the new clone, and the backend connector, which all clones share, used that one: a key missing in one request was not saved (did not save key ... as the namespace ... was not yet loaded) while a newer request was still loading its language, and the parent's services.utils answered for the newest clone. A clone's services.utils is now bound to the clone, and the parent keeps its own. A direct services.backendConnector.saveMissing() call, like the missing keys route of i18next-http-middleware, still checks the newest clone (follow-up to #1413).
  • fix: dir() without a language (before init(), or with no language resolved) returns 'ltr' instead of 'rtl' ([discussion #2135](Why 'rtl' is default direction in case of language not found? i18next/i18next#2135)).
  • fix: t() before init() returns an empty string, as typed (with a warning when debug logging is already on); it returned undefined.
  • fix: off('a b', listener) removes the listener from both events, as on('a b', listener) adds it to both. It looked for an event named 'a b', so once('a b', listener) never removed its listener and ran it on every event.
  • deprecate: dotted languages in the resource store calls (getResource('en.translation.key'), addResource('en.translation.key', value), addResourceBundle('en.translation', resources)) log a deprecation warning in debug mode; they are removed in v27. Pass language, namespace and key as separate arguments.
  • deprecate: interpolation.prefixEscaped, suffixEscaped, nestingPrefixEscaped and nestingSuffixEscaped (inserted into the RegExp unescaped) log a deprecation warning in debug mode and are marked @deprecated; they are removed in v27. Pass the literal delimiters as prefix, suffix, nestingPrefix and nestingSuffix.
  • deprecate: compatibilityJSON is marked @deprecated (it has no effect since v24) and removed from the types in v27.
  • deprecate: a language code without a region that v27 canonicalizes differently logs a deprecation warning in debug mode: 'EN' stays 'EN' today and becomes 'en' in v27, 'iw' becomes 'he'. cleanCode: true already lower-cases them.
  • deprecate: when fallbackLng is not set, the first request for the default fallback language dev (loading it, or saving missing keys to it) logs a notice in debug mode: v27 defaults to fallbackLng: false and no longer requests dev. Set fallbackLng to your source language, or to 'dev' to keep the current behavior.
  • deprecate: in debug mode, a language code that comes from lng, changeLanguage() or the language detector, is not configured (supportedLngs, fallbackLng, preload or the resources) and fails isSafeLanguageCode logs a deprecation warning, once per code: without supportedLngs, a detector that returns "><img src=x onerror=alert(1)> makes that string i18next.language, and apps put it into <html lang>. Nothing changes in 26.7; v27 is planned to refuse such codes and continue as with an unsupported code. Language codes are still not bound to a format.

... (truncated)

Commits
  • b84e418 26.7.1
  • 0a9fc2e changelog for 26.7.1
  • 61fae7e fix: reloadResources() retries bundles that failed and, without languages, re...
  • 70b64a2 26.7.0
  • f98d0c6 changelog for 26.7.0
  • 8e37fb2 ci: type check the public types on TypeScript 5.0, the lowest of the peer range
  • c976112 feat: hydrate() and services.utils.reloadResources for SSR integrations and b...
  • 9f426b2 feat: debug warnings for a missing interpolation variable, a module replaced ...
  • 1dbb93a fix: with clones, saveMissing checks the namespaces of the instance that miss...
  • 3bfbe2e feat(types): ParseKeysWithoutVariables and defaultVariables for strictInterpo...
  • Additional commits viewable in compare view

Updates react-i18next from 17.1.10 to 17.1.11

Changelog

Sourced from react-i18next's changelog.

17.1.11

  • fix(Trans): with i18next 26.7.0 or later and debug: true, the variables of object children are no longer logged as missing. When Trans interpolates before parsing (with count, values, tOptions or interpolation.defaultVariables), its t() call leaves the placeholders of object children like {{ name }} for after parsing, and i18next 26.7 logs each of them as missed to pass in variable name, although the output is right: <Trans count={n}>Hello <b>{{ name }}</b>, you have {{ count }} messages.</Trans> logged it for name. Trans now passes a missingInterpolationHandler to that call that does what i18next does without one (it keeps the placeholder, and a variable passed as undefined becomes empty), so the output is unchanged. It does not with skipOnVariables: false, a missingInterpolationHandler of your own, an i18nFormat plugin, or an escape function that would change the placeholders of the children.
Commits

Updates @vitest/coverage-v8 from 5.0.5 to 5.1.0

Release notes

Sourced from @​vitest/coverage-v8's releases.

v5.1.0

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits

Updates vitest from 5.0.5 to 5.1.0

Release notes

Sourced from vitest's releases.

v5.1.0

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits
  • 7a38449 chore: release v5.1.0 (#11838)
  • a5ec316 fix(vm): keep assignable accessor globals writabl...

    Description has been truncated

@dependabot
fix(deps)(deps): bump the dependencies group with 4 updates
e5d2c8b 
Bumps the dependencies group with 4 updates: [i18next](https://github.com/i18next/i18next), [react-i18next](https://github.com/i18next/react-i18next), [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).


Updates `i18next` from 26.6.0 to 26.7.1
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/i18next@v26.6.0...v26.7.1)

Updates `react-i18next` from 17.1.10 to 17.1.11
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](i18next/react-i18next@v17.1.10...v17.1.11)

Updates `@vitest/coverage-v8` from 5.0.5 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/coverage-v8)

Updates `vitest` from 5.0.5 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/vitest)

---
updated-dependencies:
- dependency-name: i18next
  dependency-version: 26.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: react-i18next
  dependency-version: 17.1.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 5.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: vitest
  dependency-version: 5.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file security Security related issue labels Nov 5, 2026
@github-actions
github-actions Bot merged commit 830d230 into main Nov 5, 2026
11 of 25 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/dependencies-5cc3136d9a branch November 5, 2026 21:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file security Security related issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants